CVE-2020-2805

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

• https://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlThird Party Advisory
• https://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.htmlThird Party Advisory
• https://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.htmlThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/04/msg00024.htmlThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/
• https://security.gentoo.org/glsa/202006-22Third Party Advisory
• https://security.gentoo.org/glsa/202209-15Third Party Advisory
• https://security.netapp.com/advisory/ntap-20200416-0004/Third Party Advisory
• https://usn.ubuntu.com/4337-1/Third Party Advisory
• https://www.debian.org/security/2020/dsa-4662Third Party Advisory
• https://www.debian.org/security/2020/dsa-4668Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2020.htmlVendor Advisory
• https://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlThird Party Advisory
• https://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.htmlThird Party Advisory
• https://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.htmlThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/04/msg00024.htmlThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/
• https://security.gentoo.org/glsa/202006-22Third Party Advisory
• https://security.gentoo.org/glsa/202209-15Third Party Advisory
• https://security.netapp.com/advisory/ntap-20200416-0004/Third Party Advisory
• https://usn.ubuntu.com/4337-1/Third Party Advisory
• https://www.debian.org/security/2020/dsa-4662Third Party Advisory
• https://www.debian.org/security/2020/dsa-4668Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2020.htmlVendor Advisory

Published

Apr 15, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-28043MISP through 2.4.133 allows SSRF in the REST client via the …7.5
• CVE-2020-28044An attacker with physical access to a PAX Point Of Sale devi…6.8
• CVE-2020-28045An unsigned-library issue was discovered in ProlinOS through…7.8
• CVE-2020-28046An issue was discovered in ProlinOS through 2.4.161.8859R. A…7.8
• CVE-2020-28047AudimexEE before 14.1.1 is vulnerable to Reflected XSS (Cros…5.4
• CVE-2020-28049An issue was discovered in SDDM before 0.19.0. It incorrectl…6.3
• CVE-2020-28050Zoho ManageEngine Desktop Central before build 10.0.647 allo…9.1
• CVE-2020-28052An issue was discovered in Legion of the Bouncy Castle BC Ja…8.1
• CVE-2020-28053HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 all…6.5
• CVE-2020-28054JamoDat TSMManager Collector version up to 6.5.0.21 is vulne…7.5
• CVE-2020-28055A vulnerability in the TCL Android Smart TV series V8-R851T0…7.8
• CVE-2020-2806Vulnerability in the MySQL Server product of Oracle MySQL (c…5.3